Massachusetts Federal Court Grants Summary Judgment to Media Company in VPPA Suit
In March 2025, we reported that the District of Massachusetts had denied class certification of the plaintiff’s Video Privacy Protection Act (VPPA) claims in Therrien v. Hearst Television Inc. for failure to meet the implied ascertainability requirement of Rule 23.
More recently, in April 2025, the District of Massachusetts granted summary judgment in favor of defendant Hearst Television Inc (HTV). The court found that the plaintiff failed to present sufficient evidence that the disclosures at issue constituted personally identifiable information (PII) under the VPPA and otherwise fell outside the statute’s “ordinary course of business” exception.
VPPA and HTV’s Alleged Unauthorized Disclosure of Personally Identifiable Information
Under the VPPA, 18 U.S.C. § 2710, videotape service providers are prohibited from knowingly disclosing PII concerning any of their consumers to third parties.
HTV is a news and weather broadcaster that offers mobile phone apps on which users can read articles and watch associated videos. The apps collect users’ geolocation data. To send push and email updates, HTV utilizes Braze, a third-party software-as-a-service provider. Although users have the option to enable or disable sharing geolocation data, when it is enabled, users’ geolocation data is shared with Braze. HTV also shares with Braze users’ email addresses if users opt in to receive email notifications.
In addition, HTV uses Google Ad Manager to send targeted advertisements to its apps’ users. To do this, Android users’ Android Advertising ID (AAID), a unique string of numbers used in connection with the display of ads on mobile devices, is shared with Google. AAIDs are associated with individual mobile devices but are not associated with a person’s name or address.
Therrien argued that his geolocation data, AAID, and email address all constituted PII that could not be shared with third parties without express consent.
Court Rejects Geolocation Data and AAID as Personally Identifiable Information
The court assessed whether the geolocation data shared with Braze could be used to identify Therrien. For this inquiry, the court noted that only a single geolocation data point associated with Therrien was shared with Braze. That datapoint was associated with the location of a church, which Therrien testified he attends with at least 75 other congregants.
Because this data point was to a church and not to Therrien’s home or work address, the point could not be used by anyone to identify Therrien. Moreover, because at least 75 other people frequent the church, the data point could not be used to specifically identify Therrien, either. Thus, the court held that the geolocation data point did not qualify as PII as defined under the VPPA.
The court then analyzed whether the AAID disclosed to Google would constitute PII. Although AAIDs can uniquely distinguish a user’s mobile device, Therrien’s name and home and work addresses could not be determined through the AAID associated with his phone. The court therefore held that AAIDs do not fall under the ambit of PII contemplated by the VPPA.
Therrien’s Email Address and VPPA Ordinary Course of Business Exception
Lastly, the court considered whether Therrien’s email address would be deemed to be PII. Therrien argued that an email address is per se identifiable information under the VPPA. However, the court rejected this argument, noting that there was insufficient evidence in the record that Braze could actually have used Therrien’s email address to identify him specifically.
In addition, the court made note of a narrow exception to the VPPA in which disclosures made to third parties “incident to the ordinary course of business of the video tape service provider” are permissible. 18 U.S.C. § 2710(b)(2)(E). For the purposes of the VPPA, ordinary course of business means “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Id. § 2710(a)(2).
HTV’s disclosure of Therrien’s email address to Braze fell under the ordinary course exception because it was incident to order fulfillment or request processing, as Braze acts as HTV’s vendor to assist HTV in sending newsletters and updates to users’ email addresses. In addition, Therrien disclosed his email address, signed up to receive newsletters and updates, and took no steps to unsubscribe from the emails.
Thus, the court held that, even if Therrien’s email address could have been categorized as PII under the VPPA, HTV’s disclosure of the email address to Braze fell within the ordinary course of business exception, shielding HTV from liability under the VPPA.
End of Therrien’s Privacy Class Action
Because Therrien failed to establish that any of the information disclosed would fall under the PII meant to be protected under the VPPA, the court granted summary judgment for HTV.
This case highlights the evidentiary burden plaintiffs face in VPPA litigation, particularly with respect to demonstrating the alleged disclosed information is PII that could lead to the plaintiff actually being identified.
While the outcome of this case tilts against plaintiffs, namely with the court’s invocation of the ordinary course exception to the VPPA, defendants should be wary when utilizing third parties where PII could be disseminated, especially given the rise in the application of the VPPA outside of traditional video contexts.
The VPPA’s potential reach is an issue that could soon be addressed by the Supreme Court. The National Basketball Association recently petitioned for review of the Second Circuit’s decision in Salazar v. Nat’l Basketball Ass’n that revived a plaintiff’s dismissed VPPA class action claims by determining he was a “protected consumer” under the statute despite the lower court’s conclusion he was not a subscriber of an audiovisual service by merely watching videos on the website NBA.com. The National Football League has filed an amicus brief in support of the petition for review in the Salazar case.
Whether the Supreme Court will hear the appeal is still unclear, but in the meantime, defendants should not assume that the VPPA is inapplicable to them, for as the Second Circuit stated, “[t]he VPPA is no dinosaur statute” and may be held to apply to new and “modern means of consuming content.”